Rehome to project.uhhm.no: PKGBUILD URLs, ephemeral CI token, Arch registry publishing

- PKGBUILD url/source now point at this instance's releases.
- Release uploads use the run's own ephemeral token instead of the
  GITEA_TOKEN secret.
- The publish job also builds both architectures' packages (repack
  PKGBUILD, CARCH override) and uploads them to the instance Arch
  package registry (repository name: uhhm).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GLUwWE2KmFPzhKaf67tWbx

.gitea/workflows/release.yml

@@ -65,7 +65,7 @@ jobs:
       - name: Create release
         run: |
           curl -sX POST \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             -H "Content-Type: application/json" \
             "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases" \
             -d "{\"tag_name\":\"${{ gitea.ref_name }}\",\"name\":\"${{ gitea.ref_name }}\"}" \
@@ -74,24 +74,24 @@ jobs:
       - name: Upload assets
         run: |
           RELEASE_ID=$(curl -s \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
             "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/tags/${{ gitea.ref_name }}" \
             | jq -r '.id')
 
           for FILE in "${{ env.TARBALL }}" "${{ env.TARBALL }}.sha256"; do
             # Remove any existing asset with the same name so re-runs stay clean
             EXISTING=$(curl -s \
-              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
               "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets" \
               | jq -r ".[] | select(.name == \"${FILE}\") | .id")
             for AID in $EXISTING; do
               curl -sX DELETE \
-                -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+                -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
                 "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets/${AID}"
             done
 
             curl -sX POST \
-              -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+              -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
               -H "Content-Type: application/octet-stream" \
               "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets?name=${FILE}" \
               --data-binary "@${FILE}" --fail-with-body
@@ -132,6 +132,21 @@ jobs:
           sed -i "s/sha256sums_x86_64=('.*')/sha256sums_x86_64=('${SUM_X86}')/" aur/PKGBUILD
           sed -i "s/sha256sums_aarch64=('.*')/sha256sums_aarch64=('${SUM_AARCH}')/" aur/PKGBUILD
 
+      # Also publish the built packages to this instance's Arch registry
+      # (docs.gitea.com/usage/packages/arch). The PKGBUILD only repacks the
+      # release tarballs, so CARCH can produce both architectures from this
+      # one host. Consumers: see the infrastructure README.
+      - name: Publish to the Arch package registry
+        run: |
+          cd aur
+          for carch in aarch64 x86_64; do
+            rm -f ./*.pkg.tar.zst
+            CARCH=$carch makepkg -f --nodeps
+            curl --fail --user "${{ gitea.actor }}:${{ secrets.GITHUB_TOKEN }}" \
+              --upload-file ./*-$carch.pkg.tar.zst \
+              "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/arch/uhhm"
+          done
+
       - name: Push to AUR
         env:
           AUR_SSH_KEY: ${{ secrets.AUR_SSH_KEY }}

aur/PKGBUILD

@@ -4,7 +4,7 @@ pkgver=0.2.5
 pkgrel=1
 pkgdesc="Web chat over NATS subjects with Kanidm SSO (Leptos SSR)"
 arch=('x86_64' 'aarch64')
-url="https://prosjekt.klingenbergbygg.no/bl/cnats"
+url="https://project.uhhm.no/bl/cnats"
 license=('MIT')
 depends=('glibc' 'gcc-libs')
 optdepends=(
@@ -14,8 +14,8 @@ optdepends=(
 provides=('cnats')
 conflicts=('cnats-git' 'cnats-bin')
 backup=('etc/cnats/env')
-source_x86_64=("cnats-v${pkgver}-x86_64.tar.gz::https://prosjekt.klingenbergbygg.no/bl/cnats/releases/download/v${pkgver}/cnats-v${pkgver}-x86_64.tar.gz")
+source_x86_64=("cnats-v${pkgver}-x86_64.tar.gz::https://project.uhhm.no/bl/cnats/releases/download/v${pkgver}/cnats-v${pkgver}-x86_64.tar.gz")
-source_aarch64=("cnats-v${pkgver}-aarch64.tar.gz::https://prosjekt.klingenbergbygg.no/bl/cnats/releases/download/v${pkgver}/cnats-v${pkgver}-aarch64.tar.gz")
+source_aarch64=("cnats-v${pkgver}-aarch64.tar.gz::https://project.uhhm.no/bl/cnats/releases/download/v${pkgver}/cnats-v${pkgver}-aarch64.tar.gz")
 sha256sums_x86_64=('SKIP')
 sha256sums_aarch64=('SKIP')